Summary
Polarion ALM is affected by incorrect default path permissions in installation path, and improper authentication in the REST API endpoints of DOORS connector. An attacker could exploit the vulnerabilities for unauthenticated access, or privilege escalation.
Siemens has released a new version for Polarion ALM and recommends to update to the latest version.
Vulnerabilities 2
-
High 7.8
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The affected product is vulnerable due to…
-
High 7.3
A vulnerability has been identified in Polarion ALM (All versions < V2404.0). The REST API endpoints of doorsconnector …
Revision history
-
#3
Added fix for Polarion ALM
-
#2
Added additional mitigation measures, with detailed description in Additional Information
-
#1
Publication Date
References
-
SSA-871717: Multiple Vulnerabilities in Polarion ALM - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-871717.html
-
SSA-871717: Multiple Vulnerabilities in Polarion ALM - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-871717.pdf
-
SSA-871717: Multiple Vulnerabilities in Polarion ALM - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-871717.txt